Is it an NC

Hi Experts, I have a doubt on a situation, if NC can be given or not. An outsourcing company which provides training to other companies receives new contract of training every year. This contract contains list of student who will attend training. So, during audit, you find a requirement from customer that student information should be protected as per Govt. Procedure 888. The contract manager says, he does not know about Govt. procedure 888, and only read student names to be trained. All previous year contracts does not have this Govt. Procedure 888 requirement. Apparently, they do have their own procedure to protect student information.   Now, I say it is an NC as per 4.2(b), that they failed to identify contract requirement. As per my mate, it is not an NC, as they still have their own procedure to protect student information.   What is your view on this.   Thanks Prashsax